Privacy Policy

1. Who we are

InboxMitra (https://inboxmitra.com) is operated by Toolsduniya, a sole proprietorship owned by Manvendra Pratap Singh, New House Nari Pura, C/O Nirmla Singh, Shiv Nagar Dhanoli, Agra, Uttar Pradesh 282001, India (“we”, “us”). For personal data we collect about you directly, we are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

2. What this policy covers

• Our website and the waitlist.
• The InboxMitra app (dashboard), once you create an account.
• Data we receive from Instagram and Facebook when you connect your accounts through Meta’s official APIs.

3. Data we collect

When you join the waitlist

• Name, email address, WhatsApp number and (optionally) Instagram username.
• Your consent to receive launch updates, and the time you gave it.
• Who referred you (if you joined through an invite link) and how many people joined with yours.

When you create an account

• Name, email address, password (stored only as a secure hash) or Google sign-in identifier.
• Workspace, plan, billing details and invoices (including GST details if you provide them).

When you connect Instagram or Facebook

• Account details: account ID, username, name and profile picture of the Instagram Professional account or Facebook Page you connect.
• An access token from Meta, which we store encrypted.
• Content needed to run your automations: IDs and captions of your posts and Reels, comments and messages that match your automations, and the messages we send on your behalf.
• Basic details of people who interact with you (for example their Instagram-scoped user ID, username and name), and any details they choose to share in a lead form, like email or phone number.

Payments

Payments are handled by our payment partners (PhonePe Payment Gateway, and Cashfree as a backup). We never see or store your full card, bank or UPI PIN details. We receive the transaction ID, amount, status and the payment method type.

Technical data

Server logs (IP address, browser type, pages requested, time) used for security, abuse prevention and fixing errors.

4. Cookies

We use only cookies needed for the site to work:

• rk_ref — remembers which invite link you clicked, for 60 days, so the person who invited you gets credit if you join the waitlist.
• Sign-in and security cookies in the dashboard, once accounts open.

We do not use advertising cookies. If we add analytics later, we will update this policy before we do.

5. How we use your data

• To run the waitlist, tell you when we launch and count your referrals.
• To provide the service: run your automations, send replies and DMs you set up, show contacts and analytics.
• To bill you, issue GST invoices and handle refunds.
• To send service emails (for example: account, security, billing, or a disconnected account).
• To keep the service safe, prevent spam and abuse, and follow Meta’s platform rules.
• To meet legal obligations, such as tax record-keeping.

6. Why we are allowed to use it

We process your personal data based on your consent (for example, the waitlist checkbox and connecting your accounts), and for legitimate uses allowed by the DPDP Act, such as providing a service you asked for and meeting legal obligations. You can withdraw consent at any time (see “Your rights”). Withdrawing consent does not affect processing that already happened.

7. Instagram and Facebook data

We use data from Meta’s platforms only to provide the features you set up. In particular, we:

• access only the permissions needed for the features you use;
• never sell this data, and never use it for advertising or to build profiles of people;
• never ask for your Instagram or Facebook password;
• follow Meta’s Platform Terms and Developer Policies;
• delete this data when you disconnect the account, remove our app in your Instagram/Facebook settings, or ask us to (see our Data Deletion page).

8. Data about your audience

When you use InboxMitra to talk to your followers and customers, you decide why and how their data is used, and InboxMitra processes it on your behalf. You are responsible for having a lawful reason to contact them, telling them how you use their data, and honouring their requests. If someone asks us about data a business holds about them, we will forward the request to that business and help where we can.

9. Who we share data with

We share personal data only with service providers that help us run InboxMitra, under contract:

• Hosting and servers (Hostinger).
• Email delivery provider, for waitlist and account emails.
• Payment gateways (PhonePe, Cashfree).
• Error monitoring (Sentry), with personal data kept to a minimum.
• Meta, to deliver the replies and messages you set up.

We may also share data if the law requires it or to protect our users and service. We do not sell personal data.

10. Where data is stored

Our servers are located in India (Mumbai). Some service providers (such as email delivery or error monitoring) may process data outside India. When that happens, we use providers with appropriate safeguards and follow any restrictions notified under the DPDP Act.

11. How long we keep data

• Waitlist data: until we launch and for up to 12 months after, unless you create an account or ask us to delete it sooner.
• Account data: while your account is active.
• After you delete your account or disconnect a social account: we delete the related data within 30 days.
• Invoices and payment records: as long as Indian tax law requires.
• Server logs: kept for a short period for security, then deleted.

12. How we protect data

We use HTTPS everywhere, encrypt access tokens at rest (AES-256-GCM), verify every message Meta sends us, limit staff access, and keep regular backups. No system is perfectly secure, but we work hard to protect your data and will tell you and the authorities about a personal data breach as the law requires.

13. Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to delete it, and withdraw your consent;
• nominate someone to use these rights on your behalf;
• raise a complaint with us (see “Grievance Officer”) and, if not resolved, with the Data Protection Board of India.

To use any of these rights, email hello@inboxmitra.com from the email address you used with us. We may ask you to confirm your identity.

14. Children

InboxMitra is for businesses and creators aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

15. Grievance Officer

Manvendra Pratap Singh, Toolsduniya, New House Nari Pura, C/O Nirmla Singh, Shiv Nagar Dhanoli, Agra, Uttar Pradesh 282001, India. Email: hello@inboxmitra.com. We aim to respond to every grievance as quickly as possible and within the time limits set by law.

16. Changes to this policy

If we change this policy, we will update the date at the top. For important changes, we will also tell you by email or in the dashboard before they take effect.